Add local npm registry publish and install (#139)

In-house npm packages have nowhere to publish: npm locals only accept raw file uploads, which `npm publish` and `npm install` cannot use.

- accept `npm publish` (`PUT /api/v1/local/<repo>/<pkg>`, scoped included) on local npm repos, capping the body at 256MiB and verifying the tarball against dist integrity
- write tarball, then manifest, then dist-tags; publishing an existing version returns 409 and leaves tags alone, while a matching leftover tarball from a failed publish is reused so retries complete
- serve packuments with tarball URLs pointing back at the local repo, dropping dist-tags that name unpublished versions
- document the `.npmrc` registry + `_authToken` setup in the UI and `docs/npm/local.md`
- add a stock `node:22` publish/install e2e-docker case

Reviewed-on: #139
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

ui/src/packagetypes/defs/npm.ts

@@ -2,7 +2,28 @@ import type { PackageTypeUI } from '../types';
 
 const def: PackageTypeUI = {
   color: 'red',
-  snippets: ({ proxy }) => {
+  snippets: ({ name, url, host, proxy, isLocal }) => {
+    if (isLocal) {
+      const reg = `${url}/api/v1/local/${name}/`;
+      return [
+        {
+          title: 'Configure .npmrc (registry + publish token)',
+          language: 'bash',
+          code: `cat >> .npmrc <<'EOF'
+registry=${reg}
+//${host}/api/v1/local/${name}/:_authToken=unused
+EOF`,
+          note: 'npm refuses to publish without an _authToken for the registry; any value works. For a scope only, use @<scope>:registry=… instead of registry=.',
+        },
+        {
+          title: 'Publish and install',
+          language: 'bash',
+          code: `npm publish
+npm install <package>`,
+          note: 'Versions are immutable: republishing an existing version is rejected. The dist-tags sent with the publish (latest, or --tag) move to the new version.',
+        },
+      ];
+    }
     return [
       {
         title: 'Point npm at this registry',